Antivirus

[Russell Packer]

I found that using content filters, such as SpamAssasin, could be used to block 95% of virii by simply blocking any file attachment type bar .zip. Things like FriendsGreetings and the like could be blocked on an ad-hoc basis as soon as the sys admin is aware of them by just adding a new rule. By doing that I kept the company virus free since implementation.

Just my 2 euros worth...

-----Original Message-----
From: Piet Ruyssinck [mailto:Piet.Ruyssinck at rug.ac.be]
Sent: 16 January 2003 10:23
To: info-cyrus at lists.andrew.cmu.edu
Subject: Re: Antivirus


On Wed, 15 Jan 2003, Sebastien Marmorat wrote:

> Hi,
> 
> What is the best antivirus solution for my mail server Cyrus/Postfix ?

I'm not running a production system yet, but I have a test system
running Cyrus to replace our current UWimapd based solution as soon as
the new hardware for it arrives.

On the test system, which is behaving very well, I have, besides Cyrus
2.1.11, Sendmail 8.12.6 and AmaVis
(http://www.ijs.si/software/amavisd/) (via the milter interface), with
SpamAssassin 2.43 (http://spamassassin.sourceforge.net/) and Clam
AntiVirus (http://clamav.elektrapro.com/).

A cronjob downloads the new virus database once a day.  The new Sobig
virus got first detected on Jan 14h, which is 5 days after its
breakout, iirc.  I have not enough experience with other anti-virus
solutions to decide whether 5 days is a fast or rather a slow response.
Maybe, the big commercial players have better response times.  It would
be nice to have a specs/features matrix of the available virus
scanners.



-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
Piet RUYSSINCK                            e-mail: Piet.Ruyssinck at rug.ac.be
Unix Systeem Administratie                             tel: +32 9 264 4733 
Directie Informatie- en Communicatietechnologie (ICT)  fax: +32 9 264 4994
Universiteit Gent (RUG)      Krijgslaan 281, gebouw S9 - 9000 Gent, Belgie
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
                    Please avoid sending me Word or PowerPoint attachments
                See http://www.fsf.org/philosophy/no-word-attachments.html